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Abstract 

Terrain Awareness and Warning Systems 
(TAWS) and Synthetic Vision Systems (SVS) 
provide pilots with displays of stored geo-spatial 
data (e.g. terrain, obstacles, and/or features). As 
comprehensive validation is impractical, these 
databases typically have no quantifiable level of 
integrity. This lack of a quantifiable integrity level 
is one of the constraints that has limited 
certification and operational approval of 
TAWS/S VS to “advisory-only” systems for civil 
aviation. Previous work demonstrated the 
feasibility of using a real-time monitor to bound 
database integrity by using downward-looking 
remote sensing technology (i.e. radar altimeters). 
This paper describes an extension of the integrity 
monitor concept to include a forward-looking 
sensor to cover additional classes of terrain 
database faults and to reduce the exposure time 
associated with integrity threats. An operational 
concept is presented that combines established 
feature extraction techniques with a statistical 
assessment of similarity measures between the 
sensed and stored features using principles from 
classical detection theory. Finally, an 
implementation is presented that uses existing 
commercial-off-the-shelf weather radar sensor 
technology. 

Introduction 

In an effort to reduce the risk of aviation- 
related accidents, both the FAA and NASA have 
sponsored research and development initiatives that 
seek to demonstrate National Airspace System 
(NAS) enhancements that will ultimately lead to a 
safer air transportation system. Technology 
interventions are being investigated for all of the 


major accident categories. Specifically, 
technologies to aid in averting two accident 
categories: Controlled Flight Into Terrain (CFIT) 
and Loss of Control in flight (LOC) are focal points 
of both agency’s initiatives. The primary causal 
factor leading to these CFIT and LOC accidents is 
loss of situational awareness (SA) by pilots with 
respect to their spatial location and orientation 
relative to hazards such as terrain and obstacles. 
Candidate interventions such as SVS and TAWS 
seek to improve this aspect of SA. 

Synthetic Vision Systems 

SVS presents stored geo-spatial data and 
dynamic real-time data to pilots from an ego-centric 
perspective (Figure 1). Assuming adequate 
performance, SVS has the potential to improve 
safety-of-flight and operational efficiency by 
enabling pilots to maintain their sense of “vision” 
with respect to the external environment regardless 
of the weather conditions. 



Figure 1 . SVS Display Concept 


Much of the information to be presented on the 
SVS does not change significantly over time and 
therefore, can be stored in geo-spatial databases. 
This data that is relatively static can represent 
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terrain; cultural features such as rivers and roads; 
obstacles such as buildings and towers; and 
navigation references such as nav-aid locations. 

In addition, the SVS display also presents 
dynamic data, data that does change frequently over 
time. This data must be obtained in-flight from a 
sensor, a communication channel, or the crew. 
Dynamic data includes position; traffic locations; 
weather; ATC instructions; and flight information 
services such as Notices to Airmen (NOTAMs). 
Figure 2 depicts a data abstraction for a notional 
SVS. 
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Figure 2. SVS Data Model 


Certification and operational approval of SVS 
for flight-critical applications require a system 
design that not only assures that the SVS performs 
its intended functions, but also that it does not 
provide hazardous misleading information (HMI) to 
pilots. Quantifiable levels of integrity for each of 
the data types shown in Figure 2 should be 
identified. This will determine whether pilots will 
be able to trust the SVS when they need it most 
(e.g. in Instrument Meteorological Conditions 
(IMC)). 

Many of the data types shown in Figure 2 may 
have a level of integrity. For example, attitude 
information can come from a triple-redundant 
Inertial Navigation System (INS) instead of a single 
thread system. Position data can come from a 
redundant INS coupled with one or more Global 
Positioning System (GPS) receivers and an 
augmentation service. In this paper, it is suggested 
that the proposed monitor is a practical method of 
guaranteeing a bounded level of integrity for geo- 
spatial terrain databases. 


Integrity 

The term integrity is used frequently in the 
aviation community as a performance metric. 
Unfortunately, several segments of the community 
interpret integrity differently. Specifically, there 
are three definitions of integrity that are relevant to 
material presented in this paper. For the purposes 
of this paper, they will be described as system 
integrity, data integrity, and data processing 
integrity. 

System Integrity. System integrity refers to the 
ability of the system to provide timely warnings to 
users when the system should not be used for its 
intended function. This definition is a generalized 
form of the definition of navigation system integrity 
where the intended function is navigation [1]. With 
respect to SVS, these timely warnings must be 
provided when the probability of providing HMI 
exceeds a specified bounded value. This value will 
depend on the operational use of the SVS during a 
particular phase of flight. Worst-case, it is expected 
that this value will be of the order of 10' 9 . 

One of the important and unique 
characteristics of SVS displays is the ability to 
present a compelling depiction of the external 
world. It has been suggested that because of the 
realistic character of the display information, pilots 
may feel a natural compulsion to trust it. This is a 
human factor that has yet to be addressed but 
suggests a need for high-integrity for all of the data 
types used to support the SVS display functions. 

Data Integrity. With respect to geo-spatial 
databases, required data integrity will depend on (1) 
the intended use of the data by the pilot and (2) the 
architecture of the system in which the data resides. 
One approach to illustrating this concept is to 
consider multiple levels of data integrity that 
correspond to its application’s criticality (or impact 
on safety). For example, [2] and [3] delineate five 
levels of loss of system integrity due to data errors 
that result in specified failure conditions. 
Specifically, a loss of data integrity is described as 
when data errors could cause or contribute to the 
failure of a system function resulting in a 
catastrophic, severe-major/hazardous, major, 
minor, or no effect failure condition. These five 
failure conditions correspond to a range of safety 
hazards from loss of human life to no effect at all. 
The hazard level associated with particular data in a 
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particular system is determined by a Functional 
Hazard Analysis (FHA). 

Data (database) integrity is related to system 
integrity because of the fact that system integrity 
can be compromised if data faults/errors exist in the 
database that can lead to HMI and cannot be 
detected by the operational system. Three 
techniques to improve system integrity can be 
considered in the presence of database errors: fault- 
avoidance, fault-tolerance, and fault-detection. 

Fault-avoidance requires a formal validation 
and verification wherein the designer attempts to 
prove that there are no database errors that could 
lead to HMI. Fault-tolerance requires that the 
system be designed to eliminate or mitigate the 
effects of any latent database errors that could lead 
to HMI. Typically, redundancy is used to mask the 
effects of failures that occur during the flight. 

Lastly, fault-detection requires the incorporation of 
monitor and/or built-in-test equipment (BITE) 
functions to enable detection of errors in real-time 
followed by alerting. The effect of the monitor 
and/or BITE is to lower the probability of an 
undetected failure, thereby increasing system 
integrity. 

The monitoring approach is the one that is 
described in this paper. This selection is based on 
the assumption that geo-spatial terrain databases 
will contain errors that may provide HMI under 
certain operational conditions, and that using the 
other two approaches may be impractical and/or 
infeasible. 

Data Processing Integrity. To ensure that data 
is not corrupted during processing and/or 
distribution, requirements for data processing 
integrity are also important. In [4], data processing 
integrity is defined as the degree of assurance that 
aeronautical data and its value have not been 
altered since the data origination or an authorized 
amendment. Guidelines for data processors and/or 
distributors are described in [5] that are intended to 
help ensure that data resulting from processing 
steps is no worse than the original source data. It is 
expected that the majority of geo-spatial data that is 
stored on aircraft, as part of an SVS or TAWS (e.g. 
terrain data), will not have a stated integrity with 
respect to the source data itself. The integrity 
specified with these data will only refer to “data 
processing” integrity. This is primarily due to the 


fact that the amount of validation required to 
establish and maintain an integrity value for such 
large data sets is viewed as cost prohibitive. 

Integrity Monitor Operational Concept 

Historically, various monitoring methods have 
been used to provide navigation system integrity. 

In order to attempt to “keep it simple” and avoid a 
web of ground-based integrity monitors, the 
proposed monitor implements a form of 
autonomous integrity monitoring analogous to the 
Receiver Autonomous Integrity Monitor (RAIM) 
approach used by GPS. The RAIM concept is 
based on a consistency check among multiple 
measurements that are assumed to be independent 
and uncorrelated [1]. In the case of the proposed 
method, ranging measurements to geo-spatial 
locations (e.g. terrain and obstacles) are compared 
with the expected range to these locations that are 
derived from the databases. 

To determine integrity requirements, there is a 
need to identify operational situations where an 
undetected terrain data failure could have a severe- 
major effect on airplane, crew, and passengers 
when using SVS. In other words, when can 
erroneous terrain data threaten the integrity/safety 
of the flight? Integrity threat models can be used to 
help answer this question. These models can then 
be used to support the FHA. FHAs are more 
general in nature in that many of the hazards 
described in the FHA are due to detectable failures - 
not due specifically to integrity failures. To 
develop integrity threat models for SVS, three 
classifications of IMC operations are considered: 

(1) nominal operations; (2) off-nominal operations; 
and (3) enhanced operations. Operations in Visual 
Meteorological Conditions (VMC) are not 
considered as it is assumed that SVS integrity can 
be assured sufficiently by pilots using visual 
references in these conditions. 

Nominal Operations 

This class of operations includes all existing 
operational situations where the aircraft is following 
a pre-defined and well-established course or 
procedure, including appropriate coordination with 
Air Traffic Control (ATC). During nominal 
operations, the pilot is either (1) monitoring or 
engaging autopilot modes, or (2) actively 
controlling the aircraft using flight-director type 
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guidance derived from a navigation database. 
Examples include: coupled ILS approaches and 
missed approaches that follow a defined missed 
approach procedure. During nominal operations, 
SVS will provide guidance to the published (and 
presumably correct) path using navigation data 
provided by conventional systems. In the case of 
SVS, it is expected that this will take the form of a 
tunnel in combination with flight-director guidance. 
Supplemental to this guidance symbology will be a 
depiction of terrain to improve SA. Even though 
stored terrain data may not be used to locate the 
tunnel on the display or to compute flight-director 
guidance, it has been suggested that the compelling 
nature of the SVS display may introduce HMI 
during nominal operations if the terrain data has 
insufficient integrity. 

Off-nominal Operations 

This class of operations would include 
unavoidable, inadvertent, and desirable deviations 
from the existing operational situations described 
above. These deviations may be unavoidable due 
to lack of engine performance, weather conditions, 
or on-board emergencies. Inadvertent deviations 
may be due to pilot error (e.g. distracted, VMC pilot 
in IMC). Finally, these deviation may be desirable 
if pilots deviate to save time and/or fuel for 
example. For these off-nominal operational modes, 
if the aircraft is operating near terrain in IMC and 
has deviated from the tunnel or flight-director, the 
SVS terrain depiction must be used as a primary 
navigational aid (analogous to flying under Visual 
Flight Rules (VFR)). Without an integrity monitor 
function such as the one proposed, use of SVS 
during these off-nominal operations could be 
hazardous. 

When performing off-nominal operations such 
as the ones described, it is anticipated that pilots are 
more likely to accept less integrity than for the 
nominal operations (i.e. “any nav-aid is better than 
no nav-aid”). However, is it of any benefit to give 
them a terrain display to aid navigation if it has no 
integrity? 

Enhanced Operations 

This class of operations includes new 
operational capabilities that may become feasible if 
a high-integrity SVS is available on aircraft. For 
example, it has been suggested that aircraft 
equipped with SVS may be able to fly with reduced 


minimums to particular runways. Other examples 
include: curved approaches; approaches to runways 
with little or no ground infrastructure (e.g. no IFS); 
and enabling functions such as dynamically 
generated path creation and guidance. All of these 
new operational capabilities can conceivably be 
accommodated by SVS if adequate integrity can be 
assured. 

Forward-Looking Autonomous 
Integrity Monitoring (FLAIM) 

The proposed integrity monitor uses a forward- 
looking sensor (Figure 3) to enable consistency 
checking between sensed and stored geo-spatial 
terrain data. Unlike previous work that made use of 
downward-looking radar altimeter (DFRA) 
measurements [6], the use of a forward-looking 
sensor is expected to improve the detection of 
horizontal failures while reducing minimum 
detectable biases and exposure time. Because the 
only observable using the DFRA approach is in the 
vertical direction, horizontal failures must be 
significant to be “observed” in the vertical 
measurements. Further, observing horizontal 
failures also depends on the character of the terrain 
if only looking down. By using forward-looking 
measurements, the observability of both vertical 
and horizontal failures increases. 





Figure 3. Forward-Looking Monitor Concept 


In addition to this technical advantage, there is 
also an operational advantage to using a forward- 
looking approach. For TAWS and SVS displays, 
most of the potential HMI will be “out-in-front” of 
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the pilot. By establishing integrity using 
measurements of the terrain ahead of the aircraft’s 
position, the pilot will have more time to take 
appropriate action when an integrity violation is 
detected. 

The FLAIM approach is similar to that of 
RAIM as follows: (1) it performs a consistency 
check among independent uncorrelated 
measurements; (2) it assumes that there is 
redundancy in these measurements; (3) it is based 
on statistical detection theory; (4) integrity 
requirements are based on operational use; and (5) 
it uses past and present measurements. The 
proposed solution is different from RAIM in the 
following ways: (1) the term autonomous has a 
different connotation; (2) the time-to-alarm is based 
on collision risk; (3) it provides a potential source 
of positioning integrity, and (4) it is not envisioned 
as a component of GPS receivers. 

The FLAIM approach is “autonomous” in that 
the monitor would execute in real-time independent 
of the display processing. The FLAIM approach 
does not require any ground-based infrastructure to 
provide a level of integrity. However, if the 
positioning sensor used by FLAIM (e.g. GPS) 
requires a ground infrastructure (e.g. an 
augmentation service), then one cannot say FLAIM 
would be autonomous in every sense. 

Conceptually, FLAIM acts as an intermediary 
between the source data and the SVS or TAWS 
display(s). This “watch-dog” type function checks 
any requested data against an independent source in 
a statistical manner. When a statistically significant 
difference is detected, the pilot is informed that the 
integrity of the displayed information has been 
degraded. When differences are within expected 
bounds, the pilot can be assured that the display is 
operating at its specified performance level with a 
probability consistent with the level of integrity 
required for the current operation. 

Detection based on statistical disparity results 
in a non-zero probability of false alarm (a failure is 
detected when there is no actual failure) and a non- 
zero probability of missed detection (a failure exists 
but is not detected). The detection threshold that is 
chosen will determine these probabilities. Clearly, 
the challenge is defining an appropriate test statistic 
for the expected failure modes. 


Before describing a specific implementation of 
FLAIM, the following assumptions are made: 

• The integrity of the positioning system 
(e.g. augmented differential GPS) will be 
sufficient for operational use and this 
integrity will be maintained 
independently of the database. 

• Data providers cannot guarantee that 
there will be no failures in their geo- 
spatial database products that can result 
in the presentation of HMI to the pilot. 

• Comparing stored geo-spatial data with 
sensed data increases the probability of 
detecting failures that could lead to HMI. 

• The number of database failures detected 
can be increased without introducing new 
failure modes that could lead to HMI. 

• Sensor technology already exists that can 
provide adequate performance and 
integrity to enable detection of 
significant mismatches between geo- 
spatial databases and the measurements. 
These mismatches will indicate failure 
modes that exceed a safe threshold. 

FLAIM Operational Concept 

Consider an operational environment where 
SVS displays are being used in IMC. During flight, 
FLAIM will statistically assess the consistency 
between sensed and stored geo-spatial data. When 
a prescribed threshold is exceeded, the crew will be 
notified in time to take appropriate action avoiding 
a potential incident that may otherwise have been 
induced by the SVS. These disagreements, or 
mismatches, will be detected within a prescribed 
volume in front of the aircraft’s flight path vector. 
Within this volume, four types of situations will 
occur during the operation with respect to FLAIM. 

1 . Match - sensed and stored geo-spatial data are 
both correct with respect to their stated quality 

2. Match - sensed and stored geo-spatial data are 
both equally incorrect with respect to their 
stated quality 

3. Mismatch - sensed data is incorrect with respect 
to its stated quality 

4. Mismatch - stored data is incorrect with respect 
to its stated quality 
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Type 1 situations would be the nominal case, 
that is, the SVS is faithfully presenting the scene 
within the nominal quality specification. Type 2 
situations describe database failures that cannot be 
detected by FLAIM; that is, integrity failures. 
However, on of the objectives of this work is to 
prove that the probability of a Type 2 situation 
occurring is much smaller (maybe even zero) than 
the probability of an integrity failure occurring 
without the aid of FLAIM. In Type 3 and 4 
situations, FLAIM would warn the pilot that the 
SVS is operating in a degraded mode and that 
continued flight along the same trajectory may be 
hazardous. 

It is important to note that the flight crew can, 
and will, act as another independent integrity 
monitor of geo-spatial databases. For example, in 
VMC, pilots may be able to observe gross database 
failures compared to what they see out the window. 
However, the performance of a human monitor will 
be driven by visibility conditions, workload, pilot 
experience, and other factors such as the amount of 
available information. As it is difficult to quantify 
this type of human performance, it is not 
recommended as a sole means of integrity 
assurance for stored geo-spatial databases, 
particularly in IMC. 

Sensor Technologies 

Many remote sensing technologies have been 
developed that have the potential to meet the 
operational requirements of FLAIM. Table 2 lists 
several along with some of their important 
characteristics. Notice that only two are currently 
certified and operating routinely in all weather 
conditions on civil aircraft: the radar altimeter and 
the weather radar. Radar altimeters measure height 
above ground level (AGL) from a rigid-mounted 
antenna on the belly of aircraft. They are usually 
triply redundant (3 antennas, 3 transceivers) as they 
are essential for auto-land systems during flare. 

Weather radar antennas typically scan in 
azimuth from the nose of the aircraft. Some models 
scan in elevation as well, but typically, the elevation 
angle is set by the pilot or gimbaled to remain at a 
fixed tilt angle with respect to local-level. As the 
name implies, the primary function of weather 
radars is to provide pilots with an indication of 
significant weather (moisture) in the area. 


However, returns from the ground are also received 
and displayed when the antenna beam is hitting the 
ground and ground-clutter suppression is not 
engaged. 


Table 2. Candidate FLAIM Sensors 


Sensor 

Band 

(GHz) 

Usage 

All 

Wx 

Radar/Radio 

Altimeter 

4.2-4.4 

Civil/Military 

Yes 

Weather 

Radar 

8-12 

Civil/Military 

Yes 

Doppler Radar 
Navigators 

13.25- 

13.40 

Military 

Yes 

Passive/ Active 
mm Wave 

40-300 

Experimental 

? 

Fwd-Looking 

Infra-Red 

300- le6 

Civil/Military 

? 

Laser 

Rangefinder 

-300 

Military 

? 

LiDAR 

-500 

Experimental 

? 

SAR 

Varies 

Experimental 

? 


Although a Forward-Looking Infra-Red 
(FLIR) system has recently received a 
Supplemental Type Certificate (STC) for the 
Gulfstream G-5, use of FLIR technology, in 
general, is still primarily limited to military and law 
enforcement aircraft to enable a level of “night 
vision”. 

Furthermore, both FLIR and Passive 
Millimeter Wave (PMW) are passive imaging 
sensors that do not provide range measurements. 
Integrity monitoring using these types of sensors 
would require a pattern-matching capability. Also, 
high frequency and high-resolution sensors such as 
FLIR, PMW, Laser, and the more general Light 
Detection and Ranging (LiDAR) sensors must 
contend with large attenuation in poor weather 
conditions. Overcoming these disadvantages may 
require high-quality, high-sensitivity receivers that 
may prove costly to implement and certify and still 
they may have uncertain performance with respect 
to weather effects. Doppler radar navigation 
sensors do not provide range measurements 
directly, but range can be derived if integrated with 
a positioning system. Synthetic Aperture Radar 
(SAR) techniques can be applied to various sensors 
to achieve higher resolution by taking advantage of 
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aircraft movement and accumulating measurements 
over time. 

In summary, in a perfect world, infinite power 
would be available and the smallest wavelength 
could be chosen to get the best accuracy, resolution, 
and range. Unfortunately, practicality drives the 
design decision toward the opposite conclusion. 
Despite this practical constraint of today’s 
technology, the proposed approach can be applied 
to any sensor technology. To assess the feasibility 
of the FLAIM approach, a specific implementation 
is described further that makes use of a commercial 
weather radar sensor. 

FLAIM Using Weather Radar 

Although the primary function of weather 
radar is to measure moisture-related “weather”, the 
radar will also receive echoes from the ground if its 
antenna is pointed in that direction. Previous work 
has demonstrated this capability. For example, the 
technology described in [7] is designed to detect 
terrain and obstacles and alert the pilot in time to 
avoid an incident. This is similar to the FLAIM 
problem, but is strictly a sensing function and as 
such, does not perform an integrity monitoring 
function on stored geo-spatial data. More closely 
related is the technology described in [8] which 
suggests a database verification capability using a 
weather radar sensor that interleaves weather 
measurements with terrain measurements. In [8], a 
test statistic is defined as the fraction of radar 
measurements that cannot be explained by other on- 
board data sources (including the terrain database). 

In addition, the Autonomous Precision 
Approach and Landing System (APALS) 
technology described [9] was designed to enable 
precision approaches using stored geo-spatial data 
and weather radar measurements. APALS 
accomplishes this by providing position “fixes” for 
the navigation system during final approach. 

Alternatively, for the FLAIM implementation 
described here, the weather radar equipment is not 
modified. Minimal configuration changes (e.g. 
range, scan pattern) may be required from its 
normal operational mode. No ground components 
such as reflectors at surveyed locations are required. 
Further, in order to keep the sensor measurements 
independent from database-derived “synthetic” 


measurements, the terrain database is not used to 
determine where to point the weather radar. While 
this “expectation-driven” approach can improve 
integrity, it is believed that a higher level of 
integrity can be achieved by keeping the two 
completely independent. 



Figure 4. FLAIM Using Weather Radar Sensor 

Figure 4 depicts the basic architecture of a 
FLAIM that uses weather radar measurements to 
support the in-flight consistency check function. As 
the weather radar scans in azimuth, radial 
measurements are generated. Each measurement 
consists of a reflectivity (or power-received) level 
at N range bins out to a defined range. Note: As 
specified in [10], commercial weather radars that 
are used in civil aviation generate power-received 
values at a set of quantized levels within each range 
bin. As the radar antenna scans, these Ax 1 vectors 
(radial lines) are accumulated at M azimuth angles. 
These radial lines are then input to a feature 
detection and reduction algorithm. 

The feature detection algorithm attempts to 
segment the M one-dimensional radial lines and 
classify the segments as one of L feature types. In 
addition, more than one scan of M*A measurements 
can be used to increase confidence in certain spatial 
features. 

The terrain database thread in Figure 4 
attempts to detect, segment, and classify the same L 
features to enable a one-to-one comparison between 
weather radar derived information and terrain 
database derived information. To do this, 
additional inputs are required: position, heading, 
azimuth pointing direction of the weather radar 
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antenna, and the terrain database. With this 
information, computation of the relative location of 
the terrain database with respect to the aircraft can 
be computed. The other required input to the 
terrain database thread is a model of the antenna 
beam pattern so the illuminated surface area along a 
particular pointing vector can be computed or 
estimated (Figure 5). 



Figure 5. Deriving Synthetic Measurements 
Using GPS and a Terrain Database 


After detection and classification of features 
for both sensed and database-derived 
measurements, a consistency measure is determined 
and evaluated against a preset threshold. If the 
threshold is exceeded an integrity violation is 
detected and a visual or aural alert is generated for 
the pilot. 

Feature Detection Preliminary Results 

Figure 6 provides a visual representation of the 
output of both threads of Figure 4 after the 
segmentation stage. The left plot depicts 
measurements received during a single scan of the 
weather radar (+/- 30 degrees in azimuth, zero 
degrees tilt). The right plot depicts the points in the 
same coverage area where a modeled main beam 
hit/pierced the stored terrain database from the 
perspective of the aircraft position at the same time 
as the weather image was captured. Both plots 
were generated using actual flight-test data acquired 
during the Fall of 2001 onboard a Boeing 757 
aircraft in central Colorado. 

For this illustration, no feature detection or 
classification is performed and yet an obvious 
similarity can be observed between the sensed and 
database-derived depictions. Note: the 


measurements for these plots were taken at an 
altitude of -500 feet AGL on final approach. 



Unfortunately, the weather radar terrain 
measurements cannot be mapped to the terrain 
database entries directly. The feature detection and 
extraction methods in both threads of Figure 4 are 
the steps necessary to enable a one-to-one 
comparison. The feature detection and extraction 
algorithms convert, or transform, the weather radar 
measurements and terrain database entries to a 
common domain (the feature domain) where a one- 
to-one comparison can be made. For the sensor 
measurements, development of a robust 
transformation scheme requires a good 
understanding of the underlying physics of the 
weather radar measurement mechanism. 
Furthermore, by performing feature detection and 
extraction, computational complexity is reduced, 
and derivation of a statistical model for disparity 
can be simplified. 

To illustrate, consider the following example 
using three consecutive scans during the Boeing 
757 flight mentioned above. The weather radar in 
this case was scanning at approximately 40 degrees 
per second thus covering the +/- 30 degree region 
three times in about 4.5 seconds. With 
measurements being taken at 0.25 degree 
increments, this produced 720 radial lines of N=42 
range bin measurements. Range bin size was 150 
meters. Significant features were detected using a 
feature detection and extraction algorithm based on 
shadow regions for both the radar and the synthetic 
(database-derived) data. 

For this example, two feature types are defined 
(Figure 7). L/ features are the range bins that 
represent the leading edge of shadow responses 
along each radial line. L 2 features are the number 


Presented at 21 st Digital Avionics Systems Conference, October 28-31, 2002, Irvine, CA 


of range bins that comprise the length of shadow 
responses along each radial line. Classification of 
the radial line segments as shadows is determined 
by the measured response (nominally zero). 



presence of a large bias (18.3 range bins) in our 
new residuals. This behavior suggests that 
horizontal database bias can indeed be detected by 
the proposed approach. 



Figure 7. Example of Features Extracted from a 
Radial Line Measurement 


Figure 9. Comparison of Leading Edge Feature 
Residuals With/Without Database Bias 


Figure 8 shows the resulting features for three 
scans from the Colorado flight and compares the 
agreement of the weather radar-derived features 
with the database-derived features. The residual for 
the leading edge feature is shown on the left in 
Figure 9. The mean-zero behavior is expected for 
the nominal terrain database (fault-free). 



Figure 8. Features Detected During Three Scan 
Sample (^Database, -Radar) 


Finally, a significant failure was inserted into 
the terrain database: a lateral bias of 1 km. The re- 
generated residuals (using the same weather radar 
data) are shown on the right in Figure 9. Notice the 


Status 

The research effort outlined in this paper is 
still in its early stages. Currently, various feature 
detection and classification schemes are being 
investigated in preparation for multiple flight tests 
planned over the next year. For these flight tests, a 
prototype FLAIM system is being implemented that 
can be interfaced to both a general-aviation grade 
weather radar and a high-end state-of-the-art 
transport-category weather radar. The interface to 
both weather radars is based on the ARINC 708A 
protocol [10]. The system will be evaluated during 
nominal and off-nominal operations with both fault- 
free and faulty databases. 

Once a robust feature detection and 
classification scheme has been defined, the 
probability of false alert, the probability of missed 
detection, and the minimum detectable bias can be 
related to the fault-free and faulty state of the 
terrain database and the forward-looking sensor 
statistics via the necessary transformation functions. 
Subsequently, using an appropriate test statistic, 
significant deviations from the fault- free behavior 
can then be detected to a bounded probability 
(integrity). 
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Summary and Conclusions 

The design of SVS for flight-critical 
applications requires a thorough understanding of 
the failure modes that can occur and result in the 
presentation of hazardous misleading information to 
pilots. The technology presented attempts to 
address those failure modes associated with 
incorrect terrain databases by providing an in-flight 
consistency check to ensure integrity. 

Terrain data integrity was defined in the 
expected operational context of SVS and an 
operational framework for an integrity monitor was 
established. This monitor is based on using a 
forward-looking sensor to detect horizontal and 
vertical database bias with enough time remaining 
for safe recovery. Initial testing using commercial- 
off-the-shelf weather radar technology looks 
promising but the algorithms must be fine-tuned 
and a statistical model must be derived. This 
statistical model, based on a rigorous analytical 
approach, will determine the integrity that can be 
expected from geo-spatial terrain data used in flight 
systems in conjunction with the described monitor 
function. 
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